VPC & Networking

A VPC is your private network in AWS, a subnet is a slice of it in one Availability Zone, and a subnet is public only if its route table has a route to an Internet Gateway.

An Internet Gateway is two-way internet for public resources, while a NAT Gateway gives private resources outbound-only internet and blocks every unsolicited inbound connection.

Security Group is a stateful allow-only firewall on the instance that remembers return traffic, while a NACL is a stateless allow-and-deny firewall on the subnet that treats each direction separately.

Association picks which route table an attachment uses, propagation decides which routes appear in that table, and together they control exactly which attachments can reach which, isolating environments at the routing layer.

Plan non-overlapping CIDRs centrally with room to grow, size subnets for AZs, growth, and EKS pod demand, because overlapping ranges permanently block inter-VPC communication.

A route table maps destination CIDRs to targets, one table per subnet, and the longest-prefix match decides where each packet goes.

VPC Endpoints keep traffic to AWS or partner services on the private AWS network: a Gateway Endpoint is a free route for S3 and DynamoDB, while an Interface Endpoint is a PrivateLink private-IP path for everything else.

VPC peering is a direct private link between two VPCs that is non-transitive, needs routes and firewall rules on both sides, and requires non-overlapping CIDRs.